{"id":"17d619c1-e020-4347-957e-1d1207455c93","title":"Active Directory Replication from Non Machine Account","description":"Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.","author":"Roberto Rodriguez @Cyb3rWard0g","status":"test","level":"critical","date":"2019-07-26","modified":"2021-11-27","tags":["attack.credential-access","attack.t1003.006"],"technique_ids":["T1003.006"],"logsource":{"product":"windows","service":"security"},"falsepositives":["Unknown"],"references":["https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html","https://threathunterplaybook.com/library/windows/active_directory_replication.html","https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html"],"source_path":"rules/windows/builtin/security/win_security_ad_replication_non_machine_account.yml","source_sha256":"4236a613aba88d91487212504200b3a70c08b68056d4b44e05152db6c88889be","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_ad_replication_non_machine_account.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Active Directory Replication from Non Machine Account\nid: 17d619c1-e020-4347-957e-1d1207455c93\nstatus: test\ndescription: Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.\nreferences:\n    - https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html\n    - https://threathunterplaybook.com/library/windows/active_directory_replication.html\n    - https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html\nauthor: Roberto Rodriguez @Cyb3rWard0g\ndate: 2019-07-26\nmodified: 2021-11-27\ntags:\n    - attack.credential-access\n    - attack.t1003.006\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 4662\n        AccessMask: '0x100'\n        Properties|contains:\n            - '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2'\n            - '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2'\n            - '89e95b76-444d-4c62-991a-0facbeda640c'\n    filter:\n        - SubjectUserName|endswith: '$'\n        - SubjectUserName|startswith: 'MSOL_' # https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/reference-connect-accounts-permissions#ad-ds-connector-account\n    condition: selection and not filter\nfalsepositives:\n    - Unknown\nlevel: critical\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.006","id":"T1003.006","name":"DCSync","page":"techniques/enterprise/T1003.006/"}],"data_path":"data/detection-rules/17d619c1-e020-4347-957e-1d1207455c93.json","kind":"sigma"}